dd9d1460fea1cc3e83f0f2808c80c9dbadc7f0ed39da46ddb1ad4f4c3c8d76d7 | Triage

Analysis

max time kernel
124s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 21:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dd9d1460fea1cc3e83f0f2808c80c9dbadc7f0ed39da46ddb1ad4f4c3c8d76d7.dll
Size

3KB
MD5

02d23d3ddfcebb7370543738f31a33a9
SHA1

2a5e23dab5b08e0604322d07faaac2246e5aef11
SHA256

dd9d1460fea1cc3e83f0f2808c80c9dbadc7f0ed39da46ddb1ad4f4c3c8d76d7
SHA512

9be200def5f07cc56faea984f7685bd2271b948bbda7b69542cbcf98309a664c94c7c4b3cb8879bab0feea5e1bcfc5a69e5c4886ad53ad1194f8dc3b8ba6213d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 2128	4700	rundll32.exe	67
PID 4700 wrote to memory of 2128	4700	rundll32.exe	67
PID 4700 wrote to memory of 2128	4700	rundll32.exe	67

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd9d1460fea1cc3e83f0f2808c80c9dbadc7f0ed39da46ddb1ad4f4c3c8d76d7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd9d1460fea1cc3e83f0f2808c80c9dbadc7f0ed39da46ddb1ad4f4c3c8d76d7.dll,#1
  2⤵
  PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads